CISA sets urgent deadline to fix Cisco flaw exploited in attacks
CISA mandates federal agencies patch Cisco and PTC flaws by Sunday, June 28.
CISA has issued an urgent directive, Binding Operational Directive (BOD) 26-04, requiring federal agencies to patch two critical vulnerabilities by Sunday, June 28. The first, CVE-2026-20230, is an SSRF flaw in Cisco Unified Communications Manager Server that is already being actively exploited. The second, CVE-2026-12569, is an RCE vulnerability in PTC's Windchill and FlexPLM products, also deemed critical.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo critical vulnerabilities — an SSRF flaw in Cisco Unified Communications Manager (CVE-2026-20230) and an RCE flaw in PTC Windchill/FlexPLM (CVE-2026-12569) — are being actively exploited, prompting CISA to issue a binding directive requiring federal agencies to patch by June 28. The core failure here is delayed remediation of known, critical vulnerabilities in widely deployed enterprise systems, giving attackers an open window to compromise infrastructure. SSRF flaws can allow attackers to pivot internally and reach otherwise protected systems, while RCE vulnerabilities can lead to full system takeover. This situation underscores the danger of treating patching as routine rather than urgent when active exploitation is confirmed. Organizations that lack a mature vulnerability management program with prioritization based on exploitability are most at risk.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-20230
- cve — CVE-2026-12569